Contents

The applications sniff usernames and passwords, web pages being visited, contents of email etc. Dsniff, as the name implies, it is a network sniffer, but it can also be used to disrupt the normal behavior of switched networks and cause network traffic from other hosts on the same network segment to be visible, not just traffic involving the host dsniff is running on.

The name "dsniff" refers both to the package as well as an included tool. "dsniff" the tool decodes passwords sent in cleartext across a switched or unswitched Ethernet network. Its man page explains that Song wrote dsniff with "honest intentions - to audit my own network, and to demonstrate the insecurity of cleartext network protocols." He then requests, "Please do not abuse this software."

These are the files that are configured in dsniff folder /etc/dsniff/

/etc/dsniff/dnsspoof.hosts --> Sample hosts file.[4] If no hostfile is specified, replies will be forged for all address queries on the LAN with an answer of the local machine’s IP address.

/etc/dsniff/dsniff.magic --> Network protocol magic

/etc/dsniff/dsniff.services --> Default trigger table

The man page for dsniff explains all the flags. To learn more about using dsniff you can explore the Linux man page.[5]

This is a list of descriptions for the various dsniff programs. This text belong to the dsniff “README” written by the author Dug Song.

Redirect packets from a target host (or all hosts) on the LAN intended for another local host by forging ARP replies. This is an extremely effective way of sniffing traffic on a switch. kernel IP forwarding (or a userland program which accomplishes the same, e.g. fragrouter :-) must be turned on ahead of time.

"webspy", a program which intercepts URLs sent by a specific IP address and directs your web browser to connect to the same URL. This results in your browser opening up the same web pages as the target being sniffed.

"sshmitm" and "webmitm", programs designed to intercept SSH version 1 communications and web traffic respectively with a man-in-the-middle attack